I want to create a restricted role for a specific employee. They should:
Only see Financial > Invoices in the menu (hiding Payments, Entries, Statements, etc.).
Be able to Post an invoice, but NOT Pay it.
How can I achieve it?
Being allowed to read invoices, you also need read access to party, product, account, taxes etc.
So you must create a group and give to this group only read access to the needed models.
And you must add this group to the menu entries needed to access the invoices menu.
To clarify, the goal isn’t just about granting read access. The user needs to be able to complete the entire purchase workflow and perform all invoice actions—including posting—with the sole exception of paying the invoice. How can I configure the access rights to allow posting but restrict the ‘pay’ action?
I have created a group and this is my access model section:
This is my access menu section:
Even then it is not showing the financial module to the user.
What am I missing here?
Correction on my end: I’ve achieved the desired flow. I noticed that when the invoice is processed directly through the purchases window, the user permissions work exactly as intended (they can access and post, but the payment action is restricted). Thanks for pointing me in the right direction!